SSH Server Panic via Nil CertChecker Callbacks

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

This vulnerability affects SSH servers that use the CertChecker function as a public key callback. If the server does not set the IsUserAuthority or IsHostAuthority callbacks, a client presenting a certificate can cause the server to panic.

The issue arises because CertChecker previously would panic when these callbacks were nil. The fix changes CertChecker to return an error instead of panicking in such cases.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause an SSH server to panic and potentially crash when a client presents a certificate and the server's CertChecker callbacks are not properly set.

Such a panic could lead to denial of service, disrupting SSH access and potentially impacting availability of services relying on SSH connections.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs when an SSH server uses the CertChecker function as a public key callback without setting the IsUserAuthority or IsHostAuthority fields. Detection involves verifying the SSH server configuration and code to check if CertChecker is used without these fields set.

Since the vulnerability causes the server to panic when a client presents a certificate, monitoring SSH server logs for unexpected panics or crashes during certificate authentication attempts can help detect the issue.

There are no specific commands provided in the available resources to detect this vulnerability on a network or system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that when using the CertChecker function as a public key callback in your SSH server, the IsUserAuthority and IsHostAuthority fields are properly set.

Alternatively, update the golang.org/x/crypto/ssh package to version 0.52.0 or later, where CertChecker has been fixed to return an error instead of panicking when these callbacks are nil.

Useful 0 Not Useful 0